psa_hash_compute with 8k message got error -141 built with nrf54l15dk_nrf54l15_cpuapp_ns target

[Sophak]

I am implementing sha256 with hash message bigger than or equal to 8KB. I tried with nrf54l15dk_nrf54l15_cpuapp target, and it's working fine but if I try with nrf54l15dk_nrf54l15_cpuapp_ns I got an error -141(PSA_ERROR_INSUFFICIENT_MEMORY). Likewise, I tried on sample code and got the same error: C:\ncs\v2.9.1\nrf\samples\crypto\sha256

Device: nRF54L15-DK

NCS: V2.9.1

int hash_singlepart_sha256(void)
{
    uint32_t olen;
    psa_status_t status;

    uint8_t* ptrs = malloc(1024 * 8);
    if(ptrs == NULL) {
        LOG_INF("Malloc Error %d...", 1024 * 8);
    }

    memset(ptrs, 1, 8 * 1024);


    LOG_INF("Hashing using SHA256...");

    /* Calculate the SHA256 hash */
    status = psa_hash_compute(
        PSA_ALG_SHA_256, ptrs, 1024 * 8, m_hash, sizeof(m_hash), &olen);
    if (status != PSA_SUCCESS) {
        LOG_INF("psa_hash_compute failed! (Error: %d)", status);
        return APP_ERROR;
    }

    LOG_INF("Hashing successful!");
    PRINT_HEX("SHA256 hash", m_hash, sizeof(m_hash));

    return APP_SUCCESS;
}

Could you please help and advise?

Thanks,

Sophak

[Håkon Alseth]

Hi,

 

Looks like the TFM image needs to be adjusted to handle such a large buffer.

Try to adjust CONFIG_TFM_CRYPTO_IOVEC_BUFFER_SIZE to a higher size, and see if this works.

 

Kind regards,

Håkon

[Sophak]

Thank you so much for your help.

I have tested by set CONFIG_TFM_CRYPTO_IOVEC_BUFFER_SIZE to 16KB and able to compute hash with message 8KB.

Best regards,

Sophak

[Sophak]

Hello Håkon,

Here is the config file

3603.prj.conf

Thanks and regards,

Sophak

[Håkon Alseth]

Hi Sophak,

 

Do you have CONFIG_PSA_CRYPTO_DRIVER_CRACEN selected in your project?

sec_spi.c::9 seems to trigger this error. Do you have a guard against if this is only imported for the secure build (check for CONFIG_TRUSTED_EXECUTION_SECURE) ?

 

Kind regards,

Håkon

[Sophak]

Hello Håkon,

Yes, I have selected CONFIG_PSA_CRYPTO_DRIVER_CRACEN in the project.

nrf54l15dk_nrf54l15_cpuapp_ns.conf

Yes, sec_spi.c is my source implement in secure partition (TFM secure peripheral) and I have included low level CRECAN driver in that file. That is why error triggered on that file.

#include <cracen/mem_helpers.h>
#include <cracen/statuscodes.h>
#include <sicrypto/drbghash.h>
...

Yes, It should import to the secure build only. CONFIG_TRUSTED_EXECUTION_SECURE is enabled

but the problem still occurred.

Thanks,

Sophak

[Håkon Alseth]

Hi,

 

#include cracen/*.h shall only be executed in a secure side firmware, it cannot be included in a non-secure firmware. Given your original statement:

Sophak said:

I am able to use all this API from when I build with nrf54l15dk_nrf54l15_cpuapp but when I build with nrf54l15dk_nrf54l15_cpuapp_ns, I got no such file or directory during build time.

Ie. that you can compile for _cpuapp, but not for _cpuapp_ns, it does indicate that you are including this file for both secure and non-secure firmware.

 

Could you double check this?

 

Kind regards,

Håkon

[Sophak]

Hi,

when build with _cpuapp_ns, this will separate to 2 firmwares (secure and non-secure firmware). I don't include and use it in non-secure firmware. I use it in secure TFM firmware. But it got no source file or directory during build. 

Thanks and Best Regards,

Sophak

[Håkon Alseth]

Hi,

 

Sophak said:

when build with _cpuapp_ns, this will separate to 2 firmwares (secure and non-secure firmware). I don't include and use it in non-secure firmware. I use it in secure TFM firmware. But it got no source file or directory during build. 

I am not sure I understand. Can you share the full build log of this?

 

Are your files that should only be included in the secure image guarded with a #ifdef CONFIG_TRUSTED_EXECUTION_SECURE and/or CONFIG_TRUSTED_EXECUTION_NONSECURE ?

 

Kind regards,

Håkon